🇬🇧 Europe · United Kingdom

UK UKCA / PSTI Certification Guide

The UK established its independent UKCA certification system after Brexit. The CE marking is accepted indefinitely, but the PSTI cyber security act (in force since 29 April 2024) adds new mandatory requirements for internet-connected products.

Certification Overview

Certification	Regulator	Scope	Mandatory
UKCA-RED	OPSS	Products with wireless transmitters	Mandatory (CE is a substitute)
UKCA-LVD	OPSS	Mains-powered / battery-powered products	Mandatory (CE is a substitute)
UKCA-EMC	OPSS	All electronic devices	Mandatory (CE is a substitute)
PSTI	OPSS	Internet-connected consumer products (IoT)	Mandatory (in force 29 April 2024)
UK RoHS	OPSS / Environment Agency	All electrical and electronic products	Mandatory
UK REACH	HSE	All products	Mandatory (SVHC >0.1% requires notification)

CE vs UKCA Comparison

The UK has announced it will accept the CE marking indefinitely, but we recommend doing UKCA for new products as well, in case the market requires it

Comparison	CE (EU)	UKCA (GB)
Applicable market	EU/EEA 27+ countries	Great Britain (England/Scotland/Wales)
Recognition status	UK accepts CE indefinitely (most products)	EU does not accept UKCA, separate CE is needed
Standards system	EU harmonised standards	BS EN designated standards (identical content)
Representative system	EU authorised representative (EC Rep)	UK authorised representative (UK Authorised Rep)
Certification body	Notified Body (NB)	Approved Body (AB)
Northern Ireland	Requires UKNI mark + CE/UKCA	Subject to special NI rules (follows EU)

Special note on Northern Ireland: Under the Northern Ireland Protocol, NI follows market access rules largely aligned with the EU. Do not confuse NI with GB.

PSTI Cyber Security Act (in force 29 April 2024)

Covers all internet-connected consumer products. Non-compliance can lead to delisting and recalls, with fines up to 4% of global annual turnover

Ban on universal default passwords

No default common passwords (e.g., admin/admin). Each device needs a unique password, or the user must be forced to change it before first use.

Vulnerability disclosure policy

The company website must have a public security vulnerability reporting page, including a contact email, response process and handling time limits.

Security update period statement

At launch, the product must state the minimum support period for security updates (e.g., "at least 3 years") and must honour it.

Applicable products (examples)	Non-applicable products (examples)
Smartphones/tablets/PCs, smart home (cameras/speakers/doorbells), wearables, connected appliances, connected toys	Medical devices (separate regulation), smart meters (separate regulation), enterprise IT equipment

Certification method: self-declaration (SoC) + technical documentation kept on file. Timeline approx. 1-2 weeks. No separate mark needed.

Wireless & Safety Standards

UKCA-RED

Standards: BS EN 300 328 (2.4GHz), BS EN 301 893 (5GHz), BS EN 300 330 (NFC)

Test requirements identical to CE-RED. An existing CE-RED report can be converted directly, just changing the standard reference to BS EN and issuing a UK DoC.

Samples: 1-2 units | Timeline: 3-4 weeks | UK representative required

UKCA-LVD + EMC

Safety: BS EN 62368-1, BS EN 60335 series, BS EN 62133

EMC: BS EN 55032, BS EN 55035, BS EN 61000-3-2/-3

Minimal incremental time and cost when a CE report already exists.

Other Key Requirements

UKCA mark

Affixed to the product, packaging and manual. Height ≥5mm. Can be affixed alongside the CE mark.

UK authorised representative

Non-UK manufacturers must appoint a representative within the UK, with details printed on the product/packaging. It cannot be the same entity as the EU rep unless that entity has registered addresses in both the EU and UK.

Plug / voltage

BS 1363 (Type G three flat pins, fused) at 230V/50Hz.

UK DoC

Must reference UK regulation numbers (e.g., SI 2017 No. 1206), not EU Directive numbers.

Manual

English (GB market).

5GHz band note

After Brexit, the 5150-5350MHz band has additional power restrictions in the UK, which differ from the EU and must be treated separately.

FAQs

Do I really need to do both UKCA and CE?

If you only export to the GB market, CE is already accepted indefinitely, so theoretically you can do CE alone. But given commercial client requirements, government tenders and future policy changes, we recommend doing CE + UKCA together for new products. If exporting to both the EU and UK, CE is the priority plus a UK DoC declaration and a UK representative — test reports can be shared.

How do I satisfy the three PSTI requirements?

(1) Default password — unique password per device or force the user to set it at first use. (2) Vulnerability disclosure — publish a security vulnerability reporting page on the website. (3) Security update period — explicitly state the support period (e.g., "at least 3 years") and honour it.

Can a CE-RED report be used directly for UKCA?

Generally yes. UK BS EN standards have identical test requirements to EU EN standards. You only need to change the standard reference from EN to BS EN, issue a UK DoC and affix the UKCA mark. Minimal incremental time and cost. Some laboratories can issue CE + UKCA reports together.

Can the UK representative and EU representative be the same?

No. The UK Rep must have an address in the UK and the EC Rep must have an address in the EU. Unless the entity has registered office addresses in both the EU and UK, they must be appointed separately. Many certification service providers can supply both.

Exporting products to the UK?

Combined CE + UKCA plan + PSTI compliance assessment, free certification route plan

📞 Free Consultation